Attaching derby-5395-01-ac-protectVTIs.diff. This patch implements approach (1), raising an error at instantiation time if these VTIs are invoked by someone other than the DBO when authorization is turned on. I have written a regression test but need to run the full suite.
The regression test I wrote for this fix revealed that the StatementDuration and ErrorLogReader VTIs were reading a system property outside a privileged block. I wrapped those reads in a privileged block as part of this patch.
Touches the following files:
Logic to raise an exception if authorization is enabled and the current user isn't a DBO.
Wires that check into the VTI constructors.
New regression test for this behavior.